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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G, MEADE- MARYLAND 20755-6000 

17 July 2006 

Honorable Alberto R. Gonzales 
Attorney General 
Department of Justice 
Washington, .DC 20530 

Dear Mr. Attorney General: 

(TS//SI//NF) In accordance with the Order of the Foreign Intelligence Surveillance 
Court issued May 24, 2006 in In Re Application of the Federal Bureau of Investigation for an 
Order Requiring the Production of Tangible Things from 

^^^BDocket No. BR 06-05, attached is the report provided to me by NSA’s Inspector 
General and General Counsel assessing the adequacy of the management controls for the 
processing and dissemination of U.S. person information. The Order indicated that I should 
provide the findings of the report to you. 

(U/ /FOUOH Lyou or your staff have any questions in connection with thisreporfplease 
contact^^^^^HH, Assistant Inspector General for Intelligence Oversight, 

Associate General Counsel (Operations), National SecuntyAgency7^^| 




Lieutenant General, U.S. Army 
Director, NSA/Chief, CSS 



Enel : 
a/ s 



D e riv e d From: NSA/CSS 1 - 52 
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OFFICE OF THE INSPECTOR GENERAL 
NATJO-A.L SECU-TY AGENC- 
CENT~kL SECURITY SERVICE 



10 July 2006 
IG- 10667-06 



TO: DIRECTOR, NSA 



SUBJECT: ( TSi/SI//NF ) FISA Court Order: Telephony 
Business Records (ST-06-0018) 



1. ( TS/1SI//NF ) Background and Objective. The Order of the Foreigrt 
Intelligence Surveillance Court issued 24 May 2006 in In Re Application of the 
etc.. No. BR-06-05 (Telephony Business Records) states that "[tim Inspector 
General and the General Counsel shall submit a report to the Director of NSA 45 
days after the initiation of the activity {permitted by the Order] assessing the 
adequacy of the management controls for the processing and dissemination of 
U.S. person information." This is that report. The Order further states that 
"It]he Director of NSA shall provide the findings of that report to the Attorney 
General." Order at 8-9. The Order sets no deadline for transmission of the 
findings to the Attorney General. 

2. ( TS//SI/1NF ) Finding. The management controls designed by the 
Agency to govern the processing, dissemination, security, and oversight of 
telephony metadata and U.S. person information obtained under the Order are 
adequate and in several aspects exceed the terms of the Order. However, due to 
the risk associated with the collection and processing of telephony metadata 
involving U.S. person information, three additional controls should be put in 
place, specifically, Agency management should (1) design procedures to 
provide a higher level of assurance that non-compliant data will not be collected 
and, if inadvertently collected, will be swiftly expunged and not made available 
for analysis; (2) separate the authority to approve metadata queries from the 
capability to conduct queries of metadata under the Order; and (3) conduct 
periodic reconciliation of approved telephone numbers to the logs of queried 
numbers to verify that only authorized queries have been made under the 
Order. 
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3. ( TS//St ) Further Review. The Inspector General will make formal 

recommendations to the Director, NSA/CSS, in a separate report regarding the 
design and implementation of the additional controls. 



4. (U/ /FOUO ) We appreciate the courtesy and cooperation extended 
throughout ou~ review to the auditors from the Office of the Inspector General 
and the attorneys from the Office of the General Counsel who consulted with 
them. If you need clar ification or additional Lrfformation please contact 




Inspector General 



(U// FOUO ) I endorse the conclusion that the management controls for the 
processing and disseminatio n of U.S. person information are adequate. 



ROBERT L. DEITZ 
General Counsel 



SECR;g W/CO, M. [NTI/N O, FORNi/M;R 
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